linux-kernel - Re: [PATCH 0/3] KVM: x86: cleanup and fixes for debug register accesses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200504234904.GG6299@xz-x1>
Date:   Mon, 4 May 2020 19:49:04 -0400
From:   Peter Xu <peterx@...hat.com>
To:     Paolo Bonzini <pbonzini@...hat.com>
Cc:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
        Sean Christopherson <sean.j.christopherson@...el.com>
Subject: Re: [PATCH 0/3] KVM: x86: cleanup and fixes for debug register
 accesses

On Mon, May 04, 2020 at 09:20:05PM +0200, Paolo Bonzini wrote:
> On 04/05/20 20:55, Peter Xu wrote:
> > On Mon, May 04, 2020 at 11:55:55AM -0400, Paolo Bonzini wrote:
> >> The purpose of this series is to get rid of the get_dr6 accessor
> >> and, on Intel, of set_dr6 as well.  This is done mostly in patch 2,
> >> since patch 3 is only the resulting cleanup.  Patch 1 is a related
> >> bug fix that I found while inspecting the code.
> > 
> > Reviewed-by: Peter Xu <peterx@...hat.com>
> > 
> > (Btw, the db_interception() change in patch 2 seems to be a real fix to me)
> 
> It should be okay because vcpu->arch.dr6 is not used on AMD.
> 
> However I think a kvm_update_dr6 call is missing in
> kvm_deliver_exception_payload, and kvm_vcpu_check_breakpoint should use
> kvm_queue_exception_p.

Seems correct.  Maybe apply the same thing to handle_exception_nmi() and
handle_dr()?  It's probably not a problem because VMX does not have set_dr6(),
however it's still cleaner to avoid clearing DR_TRAP_BITS and set DR6_RTM
manually before calling kvm_queue_exception() every time in VMX code.

> I'll fix all of those.
> 
> > I have that in my list, but I don't know it's "sorely" needed. :) It was low
> > after I knew the fact that we've got one test in kvm-unit-test, but I can for
> > sure do that earlier.
> > 
> > I am wondering whether we still want a test in selftests if there's a similar
> > test in kvm-unit-test already.  For this one I guess at least the guest debug
> > test is still missing.
> 
> The guest debugging test would basically cover the gdbstub case, which
> is different from kvm-unit-tests.  It would run similar tests to
> kvm-unit-tests, but #DB and #BP exceptions would be replaced by
> KVM_EXIT_DEBUG, and MOVs to DR would be replaced by KVM_SET_GUEST_DEBUG.
> 
> It could also cover exception payload support in KVM_GET_VCPU_EVENTS,
> but that is more complicated because it would require support for
> exceptions in the selftests.

Yep, I guess the in-guest debug test will still need the exception support,
though I also guess we don't need that when we have the kvm unit test, and
anyway I'll start with the simple (KVM_SET_GUEST_DEBUG).

Thanks,

-- 
Peter Xu